Indlela yokuhambisa iseva ye-VPN ye-Raspberry Pi iye ku-Ethernet

Ukushintsha i-Pi isuka ku-Wi-Fi iye ekhebula kubukeka njengomsebenzi wemizuzu emihlanu, futhi kuhlala kunjalo kuphela uma uthatha ukuhambisa njengezilungiselelo ezine ezihlukene esikhundleni sokukodwa. Igama lendawo yokugcina elishaywa amaklayenti akho lingahlala lifana ncamaku ncamaku ngesikhathi ikheli elingaphansi kwalo lishintsha. Okugqabuka ngempela isilaleli esiboshwe ekhelini elidala, ukudluliswa kwembobo okusabhekise ku-lease engenantambo, noma indlela yokubuyela ephuma ngesixhumi oyecabanga ukuthi usuyihoxisile. Lo mhlahlandlela ugcina indlela yokululama ivulekile esinyathelweni ngasinye, ngakho ukushintsha okwehlulekile kudla ukuqalisa kabusha kuphela.

Bhala abanikazi abane ngaphambi kokuxhuma noma yini

Izilungiselelo ezine zinquma ukuthi ukushintsha kuyaphila yini: ikheli le-Pi, ikheli lokubopha OpenVPN, umgomo wokuqondisa kabusha womgwaqo kanye nendlela izimpendulo ezihamba ngayo. Bhala konke lokhu ngaphambi kokuthinta ikhebula, ngoba uma i-lease engenantambo inyamalala awusakwazi ukufunda amanani amadala emshinini. Isixhumi sekhebula asizuza iphrofayela engenantambo, futhi ku-Bookworm ikheli lihlala ku-NetworkManager kuyilapho i-Bullseye ilihlala ku-dhcpcd.conf. Isibekelo esabopha ikheli le-MAC engenantambo asisho lutho mayelana ne-eth0. Thatha ikheli elisha njengokwabiwa okusha okudinga ubufakazi balo.

Old wireless lease:   10.42.7.24/24 on wlan0
New wired address:    10.42.7.31/24 on eth0
Client endpoint:      vpn.lab.example:1194/udp

Isilaleli singumnikazi wesibili. Uma isevisi iqalwe ngekheli lokubopha elithile, isokhethi ifa nesixhumi esidala; uma ibopha wonke amakheli, isokhethi iyaphila futhi umthetho womgwaqo uba yikho kuphela okusele ukulungiswa.

Umgomo wokuqondisa kabusha nendlela yokubuyela yibo abanikazi abantu ababadlulayo. Ukudluliswa okusabhekise ku-10.42.7.24 kuthumela ukuxhawulana okufikayo ekhelini i-Pi engasenalo, ngakho amaklayenti aphelelwa isikhathi ngaphandle komugqa owodwa wokuloga ohlangothini lweseva. Indlela yokubuyela ibalulekile uma zombili izixhumanisi zisebenza isikhashana, ngoba i-Pi iphendula isuka kwisixhumi esikhethwa ithebula lomgwaqo, futhi lokho akusona njalo isixhumi okwafika ngaso iphakethe. Ukuseshwa komgwaqo ngezansi kukhombisa ukuthi yimuphi umthombo okhethwa i-kernel.

Funda isokhethi langempela ngaphambi kokuthemba ikheli elisha

Amafayela okucwangcisa achaza inhloso futhi isokhethi siveza iqiniso. Buza isevisi esebenzayo ukuthi iboshwe ini esikhundleni sokuthemba ukucwangcisa okukhumbulayo. Incwadi ye-OpenVPN 2.6 ichaza --local njengokubopha ekhelini elilodwa futhi iphawula ukuthi ukukushiya kubopha zonke izixhumi.

sudo systemctl cat openvpn-server@server | grep -n -- '--local'
sudo ss -lunp '( sport = :1194 )'

Funda ikholomu yekheli lendawo esikhundleni sekholomu lesimo. Umugqa okhombisa 10.42.7.24:1194 usho ukuthi isokhethi siboshwe ekhelini osuzolikhipha, kuyilapho 0.0.0.0:1194 noma *:1194 kusho ukuthi i-daemon izolandela ngokwayo ukushintsha kwesixhumi. Uma ikheli liboshiwe, hlela iphrofayela bese uqalisa kabusha iyunithi esikhundleni sokubhala ngesandla isokhethi esiphilayo, bese uqinisekisa ukuthi isevisi isafinyelela amafayela ayo esitifiketi nokhiye.

Hamba nokuhambisa ngokulandelana okukugcina ufinyeleleka

Ukulandelana kubaluleke kakhulu kunesivinini lapha. Phakamisa isixhumanisi sekhebula ngesikhathi esingenantambo sisasebenza, qinisekisa ikheli elisha nendlela yokubuyela, bese uhoxisa iphrofayela engenantambo. Lokho kulandelana kugcina isikhathi sokusebenza sivulekile kuze kube yilapho isikhundla sifakazelwa.

ip -br addr show eth0
ip route get 203.0.113.10
nmcli -g ipv4.method,ipv4.addresses con show "Wired connection 1"

Umyalo wokuqala uphendula ukuthi eth0 uthole ikheli obuhlela lona, kanti owesibili uprinta ikheli lomthombo i-kernel ebezoqala ngalo ukuya endaweni yangaphandle, ngakho wusebenzise ngaphambi nangemva koshintsho. Uma lowo mthombo useyikheli elingenantambo, isixhumanisi sekhebula akusona indlela ekhethwayo futhi ukuhlolwa kwangaphandle kuzohluleka ngesizathu esingahlobene ne-OpenVPN. Lungisa ukukhethwa komgwaqo ngaphambi kokuthinta ukudluliswa.

Uma zombili izixhumanisi zisebenza, i-Pi ingase ithande indlela ezenzakalelayo engenantambo ngoba yafakwa kuqala noma ngoba isixhumanisi sekhebula sine-metric ephezulu. Ku-Bookworm isilungiselelo esisekelwayo yi-ipv4.route-metric kuxhumano, futhi ku-Bullseye okulingana nakho umugqa metric oqondene nesixhumi ku-dhcpcd.conf. Yehlisa ukubaluleka kwesixhumanisi esingenantambo esikhundleni sokusicisha, ukuze indlela yokubuyela ihlale iwumyalo owodwa kude.

Fakazela ithuneli kusuka ngaphandle, hhayi kusuka ku-LAN

Uxhumano lwe-VPN olusebenza kusuka kusofa lufakazela okuncane kunalokho okubonakala. Ithrafikhi evela ngaphakathi kwe-LAN iya ekhelini lomphakathi idlula emithethweni ye-hairpin noma yokubonisa abagwaqo abayisebenzisa ngokungafani, ngakho ukuhlolwa kwe-LAN okuphumelelayo kungaba khona kanye nendlela yangaphandle ephukile. Sebenzisa ifoni enedatha yeselula, noma noma iyiphi ibhokisi engaphandle kwenetworki, ekuhlolweni kokwamukela. Gcina umzamo we-LAN njengokuxilonga okukhethiwe okwehlukile.

Bese ufunda ilogi ngokulandelana okufika ngakho amaphakethe. Akukho lutho nhlobo kusho ukuthi ukuxhawulana akukaze kufinyelele ku-Pi, ngakho umgomo wokuqondisa kabusha noma udonga lomlilo lwebhokisi akulungile. Ukuxhawulana okuqala bese kuma kubonisa okhiye, izitifiketi noma i-MTU. Isikhathi esiphelelayo bese siwa ngokuvamile sisho indlela yokubuyela noma umgwaqo wesibili ozenzakalelayo, futhi umugqa welogi weklayenti Initialization Sequence Completed ukutshela ukuthi ithuneli ngokwalo likhuphukile.

sudo journalctl -u openvpn-server@server -n 40 --no-pager
sudo tcpdump -ni any udp port 1194 -c 20

Uma kungaveli lutho kulogi yeseva ngesikhathi iklayenti lizama futhi, yeka ukufunda ukucwangcisa kwe-OpenVPN bese ubuyela kumgomo wokuqondisa kabusha. Ukuthwebula kuphendula umbuzo wokufika ngemizuzwana, futhi amaphakethe angenayo angaphandle angenampendulo anciphisa inkinga emgwaqweni.

Gcina ukubuyela kwesinyathelo esisodwa bese uhoxisa iphrofayela engenantambo

Shiya iphrofayela engenantambo ifakiwe kuze kube yilapho ukuhlelwa kwekhebula kudlula ukuqalisa kabusha. nmcli con show kubala amagama ephrofayela ozowadinga, futhi iphrofayela esusiwe kufanele yakhiwe kabusha kusuka enkumbulweni ngesikhathi esibi kakhulu. Bhala igama lesixhumi, indlela yekheli kanye ne-metric eduze kwamanye amanani amane. Ukubuyela ongakubhala kusuka kunothi kubaluleke kakhulu kunalokho okufanele ukwakhe kabusha.

Ukuhoxisa ukuncika okungenantambo ukushintsha kwesici hhayi ukususa. Uma kubekwa i-connection.autoconnect no izifakazelo nomlando wamakheli kuhlala kungashiwo ngesikhathi i-Pi ivinjelwa ukuxhuma futhi kunetworki oyisukile.

nmcli con show
sudo nmcli con up "Wired connection 1"
sudo nmcli con mod "previously-used-wifi" connection.autoconnect no

Ngaphambi kokumemezela umsebenzi ukuthi uphelile, qinisekisa izinto ezine: umgomo wokuqondisa kabusha uhambisana nekheli lekhebula, isilaleli sasinda ekuqaliseni kabusha, iklayenti langaphandle liqeda ukuxhawulana, futhi i-Pi isaphendula ekhelini lekhebula ngemva kokuqalisa kabusha. Ukuqalisa kabusha kuyindlela eshibhe kakhulu yokubamba ukwabiwa obekukhona kuphela ku-kernel esebenzayo. Uma kukhona okungapheleli kokune, phakamisa futhi iphrofayela engenantambo usebenzisa sudo nmcli con up bese uqhathanisa amanani abhaliwe nalawo asebenzayo.